Security audit

stuffed-toy-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent guide for using a third-party stuffed-toy generation API, with security-relevant but disclosed external API and optional CLI use.

Install only if you are comfortable sending prompts, image references, session/task IDs, and generated outputs to the listed external services. Prefer the REST API examples or pin and verify the onekey CLI package before using npx, use a revocable API key, and avoid submitting confidential images or sharing private share_url links publicly.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:214
Finding: Unpinned npm Package Execution Through npx
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:214, SKILL.md:315, and SKILL.md:479
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippets

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_design_draft '{"prompt":"Stuffed Steve in Minecraft","images":["https://static.aiagenta2z.com/container/craftsman-agent/default/static/derekzz/a49f905b-4e0d-40c6-af7a-c37be3d1741e/3ccb042bbd9b41c3a9f5d31c564ef4c0.png"],"asset_size":"small","template_id":"stuffed-toy","provider_model_id":"default","session_name":"3D Build Plan","tag_list":"","mode":"demo"}'

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_task_create '{"prompt":"","images":["https://static.aiagenta2z.com/container/craftsman-agent/default/static/derekzz/a49f905b-4e0d-40c6-af7a-c37be3d1741e/3ccb042bbd9b41c3a9f5d31c564ef4c0.png"],"multi_view":{"front":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_front.png","right":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_right.png","back":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_back.png"},"asset_size":"small","template_id":"stuffed-toy","provider_model_id":"tripo/tripo","model":"P1-20260311","session_name":"3D Build Plan","tag_list":"","mode":"basic"}'

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_task_poll '{"task_id":"96b2116e-4b86-4d3c-af04-baf0da0c23ac","kwargs":{"provider_model_id":"tripo/tripo","mode":"basic"}}'

Technical Analysis

The documented commands invoke npx onekey without specifying an exact package version, package-integrity value, lockfile, or verified publisher. If the package is not already installed locally, npx may retrieve the currently resolved onekey package from the configured npm registry and execute it.

This creates a mut ...[truncated 1743 chars]
Remediation: View remediation
Remediation Suggestions

Replace unversioned invocation with an exact, reviewed package version, for example npx --yes onekey@<verified-exact-version> ....

Verify and document the package's official npm name, publisher identity, repository, release provenance, and expected integrity metadata.

Install dependencies from a committed lockfile using a reproducible installation process such as npm ci.

Enforce lockfile integrity and use package-signing or provenance verification where supported.

Prefer the documented direct HTTPS REST API workflow when the CLI package's provenance cannot be verified.

Run the CLI in a sandbox or restricted environment with minimal filesystem and network privileges.

Pass only the required credential to the process rather than exposing unrelated environment variables.

Use a narrowly scoped, revocable API key; rotate it if package compromise is suspected.

Add automated dependency auditing and monitoring for publisher changes, unexpected releases, and compromised transitive dependencies.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (23)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

text
[//]: # (![3D Generated Images](https://us-static.aiagenta2z.com/local/files-wd/onekey_llm_router/7485ee2a-ae58-48e3-9dc8-eaf1d3d1c4a7.png)) <img src="https://us-static.aiagenta2z.com/local/files-wd/onekey_llm_router/7485ee2a-ae58-48e3-9dc8-eaf1d3d1c4a7.png" alt="Craftsman-agent Perler Beads for Minecraft Diamond Pickaxes" width="500" /> | Section | Description |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill clearly describes sending prompts, image URLs, session IDs, and generation metadata to external services, but it does not provide users any privacy, retention, or third-party processing warning. Users may unknowingly submit sensitive prompts or proprietary images to external infrastructure and hosted workspaces.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
text
| API | Description | | -------------------------- | ------------------------------------------------------------------------------------------- | | toy_generator_design_draft | Generate a toy design draft and multi-view reference sheets from text prompts and/or images | | toy_generator_task_create | Create a new Toy 3D Generation Task from images, prompts, and/or multi-view references |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
#### Requests Input Parameter | Parameter | Description | | ----------------- | ----------------------------------------------------------------------------------------------- | | prompt | Text prompt describing the desired toy | | images | Array of source image URLs used as visual references |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
md
**mode**: The mode as complexity of design for each generation task | mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This example sends user prompts, image URLs, and authentication material to an external endpoint. External transmission is expected for this skill's functionality, but it is still security-relevant because sensitive user input and generated session data leave the local trust boundary.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs users to share or notify users of share_url links but does not warn that these URLs may embed access tokens or otherwise grant direct access to generated content. If mishandled, these links could expose private generated images, sessions, or models to unintended parties.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The 3D task creation and polling sections describe uploading reference images and hosting generated 3D assets on third-party services without clearly warning users about external processing and storage. This can lead to unintentional disclosure of proprietary designs, personal images, or commercially sensitive assets.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.
md
#### Request Input Parameters | Parameter | Description | | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
md
| Parameter | Description | | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
md
| ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
| prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
md
| images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
md
| template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.
md
| provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` | **Note**:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This request example transmits source image URLs, multi-view data, prompts, and session context to an external API to create 3D generation jobs. Because the content may include proprietary images or designs, the lack of safeguards or warnings increases the risk of unintended disclosure.
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
text
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: Polling the remote task endpoint continues to disclose task identifiers and retrieve externally hosted results, including URLs to models and previews. While necessary for operation, it confirms an ongoing dependency on external hosting and sharing that users are not adequately warned about.
Content: Scanner excerpt · SKILL.md (reported line 343)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code Snippets

Technical Analysis

Remediation Suggestions

SkillSpector

Hidden Instructions

Missing User Warnings

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

External Transmission

Missing User Warnings

Rp1

Rp1

Rp1

Missing User Warnings

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

External Transmission

External Transmission